COMPLEX NPM ATTACK USES 7+ LAYERS OF OBFUSCATION TO SPREAD PULSAR RAT

Summary from the TLDR InfoSec newsletter

Researchers from Veracode detected a malicious NPM package called “solders” which uses a post-install hook to run the malicious lib.js file without user interaction. The lib.js file obfuscates the first layer using JavaScript type coercion to build up the strings from Japanese Unicode. The decoded string then uses hex encoding, array shuffling, and binary array encoding to build a base64 encoded PowerShell script that downloads a batch script that utilizes string reordering, 3DES encryption, and steganography.